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In the Claims: 

Please replace all previous Claim Listings with the following Claim Listing: 
1-3. (Cancelled) 

4. (Currently Amended) A method of administering a countermeasure for a computer 
security threat to a computer system, comprising: 

establishing a baseline identification of an operating system type and an operating system 
release level for the computer system that is compatible with a Threat Management Vector 
(TMV); 

receiving a TMV including therein a first field that provides identification of at least one 
operating system type that is affected by a computer security threat, a second field that provides 
identification of an operating system release level for the operating system type and a third field 
that provides identification of a set of possible countermeasures for an operating system type and 
an operating system release level; and 

processing countermeasures that are identified in the TMV if the TMV identifies the 
operating system type and operating system release level for the computer system as being 
affected by the computer security threat; 

A method according to Claim 1 wherein the processing comprises: 

determining whether the TMV identifies the operating system type and operating system 
release level for the computer system as being affected by the computer security threat; 

adding at least one instance identifier to the TMV to account for multiple instances of the 
operating system running on the computer system, if the TMV identifies the operating system 
type and operating system release level for the computer system as being affected by the 
computer security threat; and 

processing countermeasures that are identified in the TMV for the instance of the 
operating system type and operating system release level when the instance of the operating 
system type and operating system release level is instantiated in the computer system. 
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5. (Original) A method according to Claim 4 wherein the processing comprises 
installing and running the countermeasure. 

6. (Currently Amended) A method of administering a countermeasure for a computer 
security threat to a computer system, comprising: 

establishing a baseline identification of an operating system type and an operating system 
release level for the computer system that is compatible with a Threat Management Vector 
(TMV); 

receiving a TMV including therein a first field that provides identification of at least one 
operating system type that is affected by a computer security threat, a second field that provides 
identification of an operating system release level for the operating system type and a third field 
that provides identification of a set of possible countermeasures for an operating system type and 
an operating system release level; and 

processing countermeasures that are identified in the TMV if the TMV identifies the 
operating system type and operating system release level for the computer system as being 
affected by the computer security threat; 
A method according to Claim 1 : 

wherein the receiving comprises receiving a TMV including therein the first field that 
provides identification of at least one operating system type that is affected by a computer 
security threat, the second field that provides identification of an operating system release level 
for the operating system type, a fourth field that provides identification of at least one application 
program type that is affected by the computer security threat and a fifth field that provides 
identification of a release level for the application program type, the third field providing 
identification of a set of possible countermeasures for the application program type and the 
application program release level; and 

wherein the processing comprises processing countermeasures that are identified in the 
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TMV if the TMV identifies the application program type and application program release level 
for the computer system as being affected by the computer security threat. 

7. (Original) A method according to Claim 6 wherein the processing further comprises: 
determining whether the TMV identifies the application program type and application 

programming release level for the computer system as being affected by the computer security 

threat; 

adding at least one instance identifier to the TMV to account for multiple instances of the 
application program running on the computer system if the TMV identifies the application 
program type and application program release level for the computer system as being affected by 
the computer security threat; and 

processing countermeasures that are identified in the TMV for the instance of the 
application program type and application program release level when the instance of the 
application program type and application program release level is instantiated in the computer 
system. 

8-21. (Cancelled) 

22. (Currently Amended) A computer program product is configured to administer a 
count ermeasure for a computer security threat to a computer system, the computer program 
product comprising a computer usable storage medium having computer-readable program code 
embodied in the medium, the computer-readable program code comprising: 

computer-readable program code that is configured to establish a baseline identification 
of an operating system type and an operating system release level for the computer system that is 
compatible with a Threat Management Vector (TMV); 

computer-readable program code that is configured to receive a TMV including therein a 
first field that provides identification of at least one operating system type that is affected by a 
computer security threat., a second field that provides identification of an operating system 
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release level for the operating system type and a third field that provides identification of a set of 
possible countermeasures for an operating system type and an operating system release level; and 

computer-readable program code that is configured to process countermeasures that are 
identified in the TMV if the TMV identifies the operating system type and operating system 
release level for the computer system as being affected by the computer security threat; 
A computer program product according to Claim 21 

wherein the computer-readable program code that is configured to process comprises: 

computer-readable program code that is configured to determine whether the TMV 
identifies the operating system type and operating system release level for the computer system 
as being affected by the computer security threat; 

computer-readable program code that is configured to add at least one instance identifier 
to the TMV to account for multiple instances of the operating system running on the computer 
system if the TMV identifies the operating system type and operating system release level for the 
computer system as being affected by the computer security threat; and 

computer-readable program code that is configured to process countermeasures that are 
identified in the TMV for the instance of the operating system type and operating system release 
level when the instance of the operating system type and operating system release level is 
instantiated in the computer system. 



